8345a4e04b105eba426233545a67642d5f036b08ac7bf13a4961127b2ae1900a

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 01:50

Target
Merchant Canceller 1.0/Merchantinator.dll
Size 48KB
Sample240622-b9cecs1hrb
SHA256 2c77a840143b3642da28d3eb1d34c631e674475ef6ce775668f94ee06c8526f9
MD5 4ebb47d2d60c6fd3e9b324e1a3a9aee9
SHA1 0bdf4cf785b9396f864eb321f219b0b0726f3856
SHA512 f001b39e1983f2137b92695df49bf52141b94600309409beee6b73c76a09d13125c4cb233456fee4f1cdc76adf071fdbe24cf8efb1a5f4387cb373fffa05e9e8
SSDEEP 768:dggXIpl73v1ny+5AuGQmqaEstl2TLJAKGefmwsdhRlyQDuzJvOZn+2D:aN73vhjAuUqaWLuKGefmwsdhJuxOZtD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	4104	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4104	1804	rundll32.exe	83
PID 1804 wrote to memory of 4104	1804	rundll32.exe	83
PID 1804 wrote to memory of 4104	1804	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Merchant Canceller 1.0\Merchantinator.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Merchant Canceller 1.0\Merchantinator.dll",#1
  2⤵
  PID:4104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 800
    3⤵
    - Program crash
    PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 4104
1⤵
PID:4700